VYPR

CVEs

343,955 total · page 6516 of 6,880

AllCriticalHighKEV
  • CVE-2006-3056Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter.

  • CVE-2006-3057Jun 16, 2006
    Networkmanager
    dhcp (dhcdbd)
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.

  • CVE-2006-2195Jun 15, 2006
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in horde 3 (horde3) before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) templates/problem/problem.inc and (2) test.php.

  • CVE-2006-2197Jun 15, 2006
    Wvware
    Wv2
    risk 0.00cvss —epss 0.03

    Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute arbitrary code via a crafted Microsoft Word document.

  • CVE-2006-2449Jun 15, 2006
    KDE
    Kde
    risk 0.00cvss —epss 0.00

    KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

  • CVE-2006-2916HigJun 15, 2006
    KDE
    Arts
    risk 0.51cvss 7.8epss 0.00

    artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.

  • CVE-2006-3019Jun 15, 2006
    Phpcms
    Phpcms
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3)…

  • CVE-2006-3020Jun 15, 2006
    WS Album
    WS-Album
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in FullPhoto.asp in WS-Album 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) image and (2) PublisedDate parameters.

  • CVE-2006-3021Jun 15, 2006
    BlueCollar
    iGallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) n and (2) d parameters in (a) login.asp and the d parameter in (b) igallery.asp.

  • CVE-2006-3022Jun 15, 2006
    Fips
    fipsGallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in zoom.php in fipsGallery 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter.

  • CVE-2006-3023Jun 15, 2006
    Uapplication
    Uphotogallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in thumbnails.asp in Uapplication Uphotogallery 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) block parameters.

  • CVE-2006-3024Jun 15, 2006
    Evgenius
    Counter
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EvGenius Counter 3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) monthly.php and (2) daily.php.

  • CVE-2006-3025Jun 15, 2006
    Chris Lea
    Lucid Calendar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cal.PHP3 in Chris Lea Lucid Calendar 0.22 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-3026Jun 15, 2006
    Clicktech
    Clickgallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ClickGallery 5.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in gallery.asp and (2) parentcurrentpage parameter in view_gallery.asp.

  • CVE-2006-3027Jun 15, 2006
    Enthrallweb
    Ephotos
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CAT_ID parameter in (a) subphotos.asp and (b) subLevel2.asp, the (2) AL_ID parameter in (c) photo.asp, and the (3) SUB_ID parameter…

  • CVE-2006-3028Jun 15, 2006
    Minerva
    Minerva
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-3029Jun 15, 2006
    Clicktech
    Clickcart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in default.asp in ClickTech Clickcart 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-3030Jun 15, 2006
    Dwzone
    Dwzone Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ToCategory and (2) FromCategory parameters to (a) ProductDetailsForm.asp and (3) UserName and (4) Password…

  • CVE-2006-3031Jun 15, 2006
    FipsCMS
    fipsCMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.asp in fipsCMS 4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) w, (2) phcat, (3) dayid, and (4) calw parameters.

  • CVE-2006-3032Jun 15, 2006
    XTREME ASP
    Photo Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xtreme ASP Photo Gallery 1.05 and earlier, and possibly 2.0 (trial), allow remote attackers to inject arbitrary web script or HTML via the (1) catname and (2) total parameters in (a) displaypic.asp, and the (3) catname…

  • CVE-2006-3033Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyScrapbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input box in singlepage.php when submitting scrapbook pages.

  • CVE-2006-3034Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.

  • CVE-2006-3035Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in addwords.php in MyScrapbook 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) comment parameters. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-3036Jun 15, 2006
    Andy Mack
    35mmslidegallery
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.

  • CVE-2006-3037Jun 15, 2006
    St
    AdManager Lite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in publish.php in ST AdManager Lite allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, (3) article, (4) bio, and (5) name parameters.

  • CVE-2006-3038Jun 15, 2006
    Cescripts
    Realty Room Rent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Room Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter. NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at…

  • CVE-2006-3039Jun 15, 2006
    Cescripts
    Realty Home Rent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Cescripts Realty Home Rent allows remote attackers to inject arbitrary web script or HTML via the sel_menu parameter. NOTE: the vendor notified CVE on 20060823 that "All issues concerning this script and others at…

  • CVE-2006-3040Jun 15, 2006
    Amr Talkbox
    Amr Talkbox
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in talkbox.php in Amr Talkbox allows remote attackers to execute arbitrary PHP code via a URL in the direct parameter. NOTE: this issue has been disputed by CVE, since the $direct variable is set to a static value just before the include…

  • CVE-2006-3041Jun 15, 2006
    Codewalkers
    Ltwcalendar
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the ltw_config[include_dir] parameter. NOTE: CVE disputes this claim, since the $ltw_config[include_dir]…

  • CVE-2006-3042Jun 15, 2006
    Ispconfig
    Ispconfig
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c)…

  • CVE-2006-3016Jun 14, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and…

  • CVE-2006-3017Jun 14, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in…

  • CVE-2006-3018Jun 14, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption.

  • CVE-2006-3015Jun 14, 2006
    Winscp
    Winscp
    risk 0.04cvss —epss 0.06

    Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.

  • CVE-2006-3009Jun 13, 2006
    Open Business Management
    OBM
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to inject arbitrary HTML or web script via the (1) tf_lang, (2) tf_name, (3) tf_user, (4) tf_lastname, (5) tf_contact, (6) tf_datebefore, and (7) tf_dateafter…

  • CVE-2006-3010Jun 13, 2006
    Obm
    Open Business Management
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to execute arbitrary SQL commands via the (1) new_order and (2) order_dir parameters to (a) index.php, (b) group/group_index.php, (c) user/user_index.php, (d)…

  • CVE-2006-0022Jun 13, 2006
    Microsoft
    Powerpoint
    risk 0.01cvss —epss 0.15

    Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which…

  • CVE-2006-0025Jun 13, 2006
    Microsoft
    Windows Media Player
    risk 0.04cvss —epss 0.49

    Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size.

  • CVE-2006-1193Jun 13, 2006
    Microsoft
    Exchange Server
    risk 0.06cvss —epss 0.39

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."

  • CVE-2006-1303Jun 13, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.38

    Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1I…

  • CVE-2006-1313Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.29

    Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code.

  • CVE-2006-2370Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.09cvss —epss 0.73

    Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the…

  • CVE-2006-2371Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.22

    Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related…

  • CVE-2006-2373Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.05cvss —epss 0.30

    The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an…

  • CVE-2006-2374MedJun 13, 2006
    Microsoft
    Windows 2000
    risk 0.39cvss 5.5epss 0.02

    The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device,…

  • CVE-2006-2378Jun 13, 2006
    Microsoft
    Ie
    risk 0.03cvss —epss 0.35

    Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Windows 98 and Me allows remote attackers to execute arbitrary code via a crafted ART image that causes heap corruption.

  • CVE-2006-2379Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.07cvss —epss 0.58

    Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.

  • CVE-2006-2380Jun 13, 2006
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.18

    Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability."

  • CVE-2006-2382Jun 13, 2006
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.49

    Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption…

  • CVE-2006-2383Jun 13, 2006
    Microsoft
    Internet Explorer
    risk 0.06cvss —epss 0.40

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet…